grpc 1.64.3 → 1.65.0

data/third_party/boringssl-with-bazel/src/include/openssl/experimental/dilithium.h

@@ -0,0 +1,125 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_DILITHIUM_H
+#define OPENSSL_HEADER_DILITHIUM_H
+
+#include <openssl/base.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+#if defined(OPENSSL_UNSTABLE_EXPERIMENTAL_DILITHIUM)
+// This header implements experimental, draft versions of not-yet-standardized
+// primitives. When the standard is complete, these functions will be removed
+// and replaced with the final, incompatible standard version. They are
+// available now for short-lived experiments, but must not be deployed anywhere
+// durable, such as a long-lived key store. To use these functions define
+// OPENSSL_UNSTABLE_EXPERIMENTAL_DILITHIUM.
+
+// Dilithium3.
+
+
+// DILITHIUM_private_key contains a Dilithium3 private key. The contents of this
+// object should never leave the address space since the format is unstable.
+struct DILITHIUM_private_key {
+  union {
+    uint8_t bytes[32 + 32 + 64 + 256 * 4 * (5 + 6 + 6)];
+    uint32_t alignment;
+  } opaque;
+};
+
+// DILITHIUM_public_key contains a Dilithium3 public key. The contents of this
+// object should never leave the address space since the format is unstable.
+struct DILITHIUM_public_key {
+  union {
+    uint8_t bytes[32 + 64 + 256 * 4 * 6];
+    uint32_t alignment;
+  } opaque;
+};
+
+// DILITHIUM_PRIVATE_KEY_BYTES is the number of bytes in an encoded Dilithium3
+// private key.
+#define DILITHIUM_PRIVATE_KEY_BYTES 4032
+
+// DILITHIUM_PUBLIC_KEY_BYTES is the number of bytes in an encoded Dilithium3
+// public key.
+#define DILITHIUM_PUBLIC_KEY_BYTES 1952
+
+// DILITHIUM_SIGNATURE_BYTES is the number of bytes in an encoded Dilithium3
+// signature.
+#define DILITHIUM_SIGNATURE_BYTES 3309
+
+// DILITHIUM_generate_key generates a random public/private key pair, writes the
+// encoded public key to |out_encoded_public_key| and sets |out_private_key| to
+// the private key. Returns 1 on success and 0 on failure.
+OPENSSL_EXPORT int DILITHIUM_generate_key(
+    uint8_t out_encoded_public_key[DILITHIUM_PUBLIC_KEY_BYTES],
+    struct DILITHIUM_private_key *out_private_key);
+
+// DILITHIUM_sign generates a signature for the message |msg| of length
+// |msg_len| using |private_key| following the randomized algorithm, and writes
+// the encoded signature to |out_encoded_signature|. Returns 1 on success and 0
+// on failure.
+OPENSSL_EXPORT int DILITHIUM_sign(
+    uint8_t out_encoded_signature[DILITHIUM_SIGNATURE_BYTES],
+    const struct DILITHIUM_private_key *private_key, const uint8_t *msg,
+    size_t msg_len);
+
+// DILITHIUM_verify verifies that |encoded_signature| constitutes a valid
+// signature for the message |msg| of length |msg_len| using |public_key|.
+OPENSSL_EXPORT int DILITHIUM_verify(
+    const struct DILITHIUM_public_key *public_key,
+    const uint8_t encoded_signature[DILITHIUM_SIGNATURE_BYTES],
+    const uint8_t *msg, size_t msg_len);
+
+
+// Serialisation of keys.
+
+// DILITHIUM_marshal_public_key serializes |public_key| to |out| in the standard
+// format for Dilithium public keys. It returns one on success or zero on
+// allocation error.
+OPENSSL_EXPORT int DILITHIUM_marshal_public_key(
+    CBB *out, const struct DILITHIUM_public_key *public_key);
+
+// DILITHIUM_parse_public_key parses a public key, in the format generated by
+// |DILITHIUM_marshal_public_key|, from |in| and writes the result to
+// |out_public_key|. It returns one on success or zero on parse error or if
+// there are trailing bytes in |in|.
+OPENSSL_EXPORT int DILITHIUM_parse_public_key(
+    struct DILITHIUM_public_key *public_key, CBS *in);
+
+// DILITHIUM_marshal_private_key serializes |private_key| to |out| in the
+// standard format for Dilithium private keys. It returns one on success or zero
+// on allocation error.
+OPENSSL_EXPORT int DILITHIUM_marshal_private_key(
+    CBB *out, const struct DILITHIUM_private_key *private_key);
+
+// DILITHIUM_parse_private_key parses a private key, in the format generated by
+// |DILITHIUM_marshal_private_key|, from |in| and writes the result to
+// |out_private_key|. It returns one on success or zero on parse error or if
+// there are trailing bytes in |in|.
+OPENSSL_EXPORT int DILITHIUM_parse_private_key(
+    struct DILITHIUM_private_key *private_key, CBS *in);
+
+#endif  // OPENSSL_UNSTABLE_EXPERIMENTAL_DILITHIUM
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_DILITHIUM_H

data/third_party/boringssl-with-bazel/src/include/openssl/x509.h

@@ -5294,29 +5294,6 @@ OPENSSL_EXPORT void X509_STORE_set_verify_cb(
 #define X509_STORE_set_verify_cb_func(store, func) \
   X509_STORE_set_verify_cb((store), (func))
 
-typedef int (*X509_STORE_CTX_get_crl_fn)(X509_STORE_CTX *ctx, X509_CRL **crl,
-                                         X509 *x);
-typedef int (*X509_STORE_CTX_check_crl_fn)(X509_STORE_CTX *ctx, X509_CRL *crl);
-
-// X509_STORE_set_get_crl override's |store|'s logic for looking up CRLs.
-//
-// Do not use this function. It is temporarily retained to support one caller
-// and will be removed after that caller is fixed. It is not possible for
-// external callers to correctly implement this callback. The real
-// implementation sets some inaccessible internal state on |X509_STORE_CTX|.
-OPENSSL_EXPORT void X509_STORE_set_get_crl(X509_STORE *store,
-                                           X509_STORE_CTX_get_crl_fn get_crl);
-
-// X509_STORE_set_check_crl override's |store|'s logic for checking CRL
-// validity.
-//
-// Do not use this function. It is temporarily retained to support one caller
-// and will be removed after that caller is fixed. It is not possible for
-// external callers to correctly implement this callback. The real
-// implementation relies some inaccessible internal state on |X509_STORE_CTX|.
-OPENSSL_EXPORT void X509_STORE_set_check_crl(
-    X509_STORE *store, X509_STORE_CTX_check_crl_fn check_crl);
-
 // X509_STORE_CTX_set_chain configures |ctx| to use |sk| for untrusted
 // intermediate certificates to use in verification. This function is redundant
 // with the |chain| parameter of |X509_STORE_CTX_init|. Use the parameter

data/third_party/boringssl-with-bazel/src/ssl/dtls_method.cc

@@ -89,7 +89,7 @@ static bool dtls1_set_read_state(SSL *ssl, ssl_encryption_level_t level,
   }
 
   ssl->d1->r_epoch++;
-  OPENSSL_memset(&ssl->d1->bitmap, 0, sizeof(ssl->d1->bitmap));
+  ssl->d1->bitmap = DTLS1_BITMAP();
   ssl->s3->read_sequence = 0;
 
   ssl->s3->aead_read_ctx = std::move(aead_ctx);

data/third_party/boringssl-with-bazel/src/ssl/internal.h

@@ -229,11 +229,6 @@ UniquePtr<T> MakeUnique(Args &&... args) {
   return UniquePtr<T>(New<T>(std::forward<Args>(args)...));
 }
 
-// TODO(davidben): Remove these macros after April 2024, once the C++ runtime
-// dependency has stuck.
-#define HAS_VIRTUAL_DESTRUCTOR
-#define PURE_VIRTUAL = 0
-
 // Array<T> is an owning array of elements of |T|.
 template <typename T>
 class Array {
@@ -1123,18 +1118,17 @@ class SSLKeyShare {
  public:
   virtual ~SSLKeyShare() {}
   static constexpr bool kAllowUniquePtr = true;
-  HAS_VIRTUAL_DESTRUCTOR
 
   // Create returns a SSLKeyShare instance for use with group |group_id| or
   // nullptr on error.
   static UniquePtr<SSLKeyShare> Create(uint16_t group_id);
 
   // GroupID returns the group ID.
-  virtual uint16_t GroupID() const PURE_VIRTUAL;
+  virtual uint16_t GroupID() const = 0;
 
   // Generate generates a keypair and writes the public key to |out_public_key|.
   // It returns true on success and false on error.
-  virtual bool Generate(CBB *out_public_key) PURE_VIRTUAL;
+  virtual bool Generate(CBB *out_public_key) = 0;
 
   // Encap generates an ephemeral, symmetric secret and encapsulates it with
   // |peer_key|. On success, it returns true, writes the encapsulated secret to
@@ -1142,13 +1136,13 @@ class SSLKeyShare {
   // it returns false and sets |*out_alert| to an alert to send to the peer.
   virtual bool Encap(CBB *out_ciphertext, Array<uint8_t> *out_secret,
                      uint8_t *out_alert,
-                     Span<const uint8_t> peer_key) PURE_VIRTUAL;
+                     Span<const uint8_t> peer_key) = 0;
 
   // Decap decapsulates the symmetric secret in |ciphertext|. On success, it
   // returns true and sets |*out_secret| to the shared secret. On failure, it
   // returns false and sets |*out_alert| to an alert to send to the peer.
   virtual bool Decap(Array<uint8_t> *out_secret, uint8_t *out_alert,
-                     Span<const uint8_t> ciphertext) PURE_VIRTUAL;
+                     Span<const uint8_t> ciphertext) = 0;
 
   // SerializePrivateKey writes the private key to |out|, returning true if
   // successful and false otherwise. It should be called after |Generate|.